CVE-2026-54500: ohler55 Oj uninitialized stack memory read in intern.c

CVE-2026-54500 · Severity: medium · CVSS 5.3 · Published 2026-07-01

Oj, a high-performance JSON processing library for Ruby, contains a flaw that can expose sensitive information from a server's memory. When the library processes specially crafted JSON data with very long keys, it may inadvertently read and return internal system memory instead of the intended data. This could allow an attacker to see fragments of other data currently being processed by the application, potentially including sensitive configuration or user information.

Technologies: oj (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54500 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54500 being exploited in the wild.
How severe is CVE-2026-54500?
Medium severity, with a CVSS score of 5.3, published 1 July 2026.
Which products and versions are affected?
oj (RubyGems) < 3.17.3, ECOSYSTEM:introduced=0,fixed=3.17.3.
Is there a fix for CVE-2026-54500?
Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54500 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54500?
Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oj (RubyGems): upgrade to 3.17.3 or later
    bundle update oj

Technical details

A vulnerability exists in the `form_attr()` function within `ext/oj/intern.c` of the Oj Ruby gem. When parsing JSON in `:object` mode, the library fails to correctly reference a newly allocated heap buffer for keys exceeding 253 bytes, instead passing an uninitialized stack buffer to `rb_intern3()`. For keys 254-255 bytes, this results in an uninitialized stack read; for keys 256 bytes or longer, it triggers an out-of-bounds read (CWE-125). An attacker can recover leaked stack memory if the application returns the resulting Symbol or the `EncodingError` message (triggered by invalid UTF-8 in the leaked memory) to the user. The issue is fixed in version 3.17.3.

Affected products

  • ohler55 oj < 3.17.3

Identifiers

  • CVE-2026-54500
  • GHSA-fm7p-mprw-wjm9

Timeline

  • 2026-06-16: advisory: GitHub Security Advisory published by maintainer
  • 2026-07-01: disclosed: NVD publication date
  • 2026-06-16: patched: Fixed in version 3.17.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.